Cross-Site Request Forgery Vulnerability in PingFederate Administrative Console
CVE-2025-32736

4.9MEDIUM

Key Information:

Vendor

Ping Identity

Status
Pingfederate
Vendor
CVE Published:
10 August 2026

What is CVE-2025-32736?

The Administrative Console of PingFederate versions prior to 13.1 is susceptible to Cross-Site Request Forgery (CSRF) attacks. Malicious actors could exploit this vulnerability by using specially crafted links that can trigger unauthorized actions when clicked by logged-in administrators. This issue emphasizes the need for robust CSRF protection and vigilance in managing administrative sessions to prevent potential security breaches.

Affected Version(s)

PingFederate Windows 10.0 < 13.1

References

https://docs.pingidentity.com/pingfederate/13.1/release_n...
https://www.pingidentity.com/en/resources/downloads/pingf...

CVSS V4

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michal Rowiński
.